@npmcli/arborist 2.2.4 → 2.2.8

package/lib/arborist/build-ideal-tree.js

@@ -431,11 +431,13 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     // ie, doing `foo@bar` we just return foo
     // but if it's a url or git, we don't know the name until we
     // fetch it and look in its manifest.
-    return Promise.all(add.map(rawSpec =>
-      this[_retrieveSpecName](npa(rawSpec))
+    return Promise.all(add.map(rawSpec => {
+      // We do NOT provide the path here, because user-additions need
+      // to be resolved relative to the CWD the user is in.
+      return this[_retrieveSpecName](npa(rawSpec))
         .then(add => this[_updateFilePath](add))
         .then(add => this[_followSymlinkPath](add))
-    )).then(add => {
+    })).then(add => {
       this[_resolvedAdd] = add
       // now add is a list of spec objects with names.
       // find a home for each of them!
@@ -881,6 +883,8 @@ This is a one-time fix-up, please be patient...
     // create a virtual root node with the same deps as the node that
     // is requesting this one, so that we can get all the peer deps in
     // a context where they're likely to be resolvable.
+    // Note that the virtual root will also have virtual copies of the
+    // targets of any child Links, so that they resolve appropriately.
     const parent = parent_ || this[_virtualRoot](edge.from)
     const realParent = edge.peer ? edge.from.resolveParent : edge.from
 
@@ -934,11 +938,23 @@ This is a one-time fix-up, please be patient...
       return this[_virtualRoots].get(node)
 
     const vr = new Node({
-      path: '/virtual-root',
+      path: node.realpath,
       sourceReference: node,
       legacyPeerDeps: this.legacyPeerDeps,
     })
 
+    // also need to set up any targets from any link deps, so that
+    // they are properly reflected in the virtual environment
+    for (const child of node.children.values()) {
+      if (child.isLink) {
+        new Node({
+          path: child.realpath,
+          sourceReference: child.target,
+          root: vr,
+        })
+      }
+    }
+
     this[_virtualRoots].set(node, vr)
     return vr
   }

package/lib/arborist/index.js

@@ -28,6 +28,7 @@
 
 const {resolve} = require('path')
 const {homedir} = require('os')
+const procLog = require('../proc-log.js')
 
 const mixins = [
   require('../tracker.js'),
@@ -54,6 +55,7 @@ class Arborist extends Base {
       path: options.path || '.',
       cache: options.cache || `${homedir()}/.npm/_cacache`,
       packumentCache: new Map(),
+      log: options.log || procLog,
     }
     this.cache = resolve(this.options.cache)
     this.path = resolve(this.options.path)

package/lib/arborist/reify.js

@@ -6,6 +6,7 @@ const rpj = require('read-package-json-fast')
 const { updateDepSpec } = require('../dep-spec.js')
 const AuditReport = require('../audit-report.js')
 const {subset} = require('semver')
+const npa = require('npm-package-arg')
 
 const {dirname, resolve, relative} = require('path')
 const {depth: dfwalk} = require('treeverse')
@@ -881,11 +882,17 @@ module.exports = cls => class Reifier extends cls {
 
     process.emit('time', 'reify:save')
 
+    // resolvedAdd is the list of user add requests, but with names added
+    // to things like git repos and tarball file/urls.  However, if the
+    // user requested 'foo@', and we have a foo@file:../foo, then we should
+    // end up saving the spec we actually used, not whatever they gave us.
     if (this[_resolvedAdd]) {
       const root = this.idealTree
       const pkg = root.package
-      for (const req of this[_resolvedAdd]) {
-        const {name, rawSpec, subSpec} = req
+      for (const { name } of this[_resolvedAdd]) {
+        const req = npa(root.edgesOut.get(name).spec, root.realpath)
+        const {rawSpec, subSpec} = req
+
         const spec = subSpec ? subSpec.rawSpec : rawSpec
         const child = root.children.get(name)
 
@@ -910,6 +917,15 @@ module.exports = cls => class Reifier extends cls {
           const save = h.https && h.auth ? `git+${h.https(opt)}`
             : h.shortcut(opt)
           updateDepSpec(pkg, name, save)
+        } else if (req.type === 'directory' || req.type === 'file') {
+          // save the relative path in package.json
+          // Normally saveSpec is updated with the proper relative
+          // path already, but it's possible to specify a full absolute
+          // path initially, in which case we can end up with the wrong
+          // thing, so just get the ultimate fetchSpec and relativize it.
+          const p = req.fetchSpec.replace(/^file:/, '')
+          const rel = relpath(root.realpath, p)
+          updateDepSpec(pkg, name, `file:${rel}`)
         } else
           updateDepSpec(pkg, name, req.saveSpec)
       }

package/lib/edge.js

@@ -87,16 +87,24 @@ class Edge {
 
   // return the edge data, and an explanation of how that edge came to be here
   [_explain] (seen) {
-    const { error, from } = this
+    const { error, from, bundled } = this
     return {
       type: this.type,
       name: this.name,
       spec: this.spec,
+      ...(bundled ? { bundled } : {}),
       ...(error ? { error } : {}),
       ...(from ? { from: from.explain(null, seen) } : {}),
     }
   }
 
+  get bundled () {
+    if (!this.from)
+      return false
+    const { package: { bundleDependencies = [] } } = this.from
+    return bundleDependencies.includes(this.name)
+  }
+
   get workspace () {
     return this[_type] === 'workspace'
   }

package/lib/printable.js

@@ -63,6 +63,13 @@ class ArboristNode {
   }
 }
 
+class ArboristVirtualNode extends ArboristNode {
+  constructor (tree, path) {
+    super(tree, path)
+    this.sourceReference = printableTree(tree.sourceReference, path)
+  }
+}
+
 class ArboristLink extends ArboristNode {
   constructor (tree, path) {
     super(tree, path)
@@ -119,10 +126,14 @@ class EdgeIn extends Edge {
 }
 
 const printableTree = (tree, path = []) => {
-  if (path.includes(tree))
-    return { location: tree.location }
+  const Cls = tree.isLink ? ArboristLink
+    : tree.sourceReference ? ArboristVirtualNode
+    : ArboristNode
+  if (path.includes(tree)) {
+    const obj = Object.create(Cls.prototype)
+    return Object.assign(obj, { location: tree.location })
+  }
   path.push(tree)
-  const Cls = tree.isLink ? ArboristLink : ArboristNode
   return new Cls(tree, path)
 }
 

package/lib/shrinkwrap.js

@@ -32,6 +32,7 @@ const mismatch = (a, b) => a && b && a !== b
 // After calling this.commit(), any nodes not present in the tree will have
 // been removed from the shrinkwrap data as well.
 
+const procLog = require('./proc-log.js')
 const YarnLock = require('./yarn-lock.js')
 const {promisify} = require('util')
 const rimraf = promisify(require('rimraf'))
@@ -39,7 +40,24 @@ const fs = require('fs')
 const readFile = promisify(fs.readFile)
 const writeFile = promisify(fs.writeFile)
 const stat = promisify(fs.stat)
-const readdir = promisify(fs.readdir)
+const readdir_ = promisify(fs.readdir)
+const readlink = promisify(fs.readlink)
+
+// XXX remove when drop support for node v10
+const lstat = promisify(fs.lstat)
+/* istanbul ignore next - version specific polyfill */
+const readdir = async (path, opt) => {
+  if (!opt || !opt.withFileTypes)
+    return readdir_(path, opt)
+  const ents = await readdir_(path, opt)
+  if (typeof ents[0] === 'string') {
+    return Promise.all(ents.map(async ent => {
+      return Object.assign(await lstat(path + '/' + ent), { name: ent })
+    }))
+  }
+  return ents
+}
+
 const { resolve, basename } = require('path')
 const specFromLock = require('./spec-from-lock.js')
 const versionFromTgz = require('./version-from-tgz.js')
@@ -159,10 +177,19 @@ const assertNoNewer = async (path, data, lockTime, dir = path, seen = null) => {
     : readdir(parent, { withFileTypes: true })
 
   return children.catch(() => [])
-    .then(ents => Promise.all(
-      ents.filter(ent => ent.isDirectory() && !/^\./.test(ent.name))
-        .map(ent => assertNoNewer(path, data, lockTime, resolve(parent, ent.name), seen))
-    )).then(() => {
+    .then(ents => Promise.all(ents.map(async ent => {
+      const child = resolve(parent, ent.name)
+      if (ent.isDirectory() && !/^\./.test(ent.name))
+        await assertNoNewer(path, data, lockTime, child, seen)
+      else if (ent.isSymbolicLink()) {
+        const target = resolve(parent, await readlink(child))
+        const tstat = await stat(target).catch(() => null)
+        seen.add(relpath(path, child))
+        if (tstat && tstat.isDirectory() && !seen.has(relpath(path, target)))
+          await assertNoNewer(path, data, lockTime, target, seen)
+      }
+    })))
+    .then(() => {
       if (dir !== path)
         return
 
@@ -265,7 +292,10 @@ class Shrinkwrap {
       newline = '\n',
       shrinkwrapOnly = false,
       hiddenLockfile = false,
+      log = procLog,
     } = options
+
+    this.log = log
     this[_awaitingUpdate] = new Map()
     this.tree = null
     this.path = resolve(path || '.')
@@ -398,6 +428,8 @@ class Shrinkwrap {
       // all good!  hidden lockfile is the newest thing in here.
       return data
     }).catch(er => {
+      const rel = relpath(this.path, this.filename)
+      this.log.verbose('shrinkwrap', `failed to load ${rel}`, er)
       this.loadingError = er
       this.loadedFromDisk = false
       this.ancientLockfile = false

package/lib/tracker.js

@@ -1,13 +1,12 @@
-const procLog = require('./proc-log.js')
-
 const _progress = Symbol('_progress')
 const _onError = Symbol('_onError')
+const procLog = require('./proc-log.js')
 
 module.exports = cls => class Tracker extends cls {
   constructor (options = {}) {
     super(options)
-    this[_progress] = new Map()
     this.log = options.log || procLog
+    this[_progress] = new Map()
   }
 
   addTracker (section, subsection = null, key = null) {

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@npmcli/arborist",
-  "version": "2.2.4",
+  "version": "2.2.8",
   "description": "Manage node_modules trees",
   "dependencies": {
-    "@npmcli/installed-package-contents": "^1.0.6",
+    "@npmcli/installed-package-contents": "^1.0.7",
     "@npmcli/map-workspaces": "^1.0.2",
     "@npmcli/metavuln-calculator": "^1.1.0",
     "@npmcli/move-file": "^1.1.0",
@@ -46,7 +46,8 @@
     "tcompare": "^3.0.4"
   },
   "scripts": {
-    "test": "tap",
+    "test": "npm run test-only --",
+    "test-only": "tap",
     "posttest": "npm run lint",
     "snap": "tap",
     "postsnap": "npm run lint",
@@ -76,12 +77,16 @@
   },
   "tap": {
     "100": true,
-    "node-arg": [
-      "--unhandled-rejections=strict"
-    ],
     "after": "test/fixtures/cleanup.js",
     "coverage-map": "map.js",
     "esm": false,
+    "test-env": [
+      "NODE_OPTIONS=--no-warnings"
+    ],
+    "node-arg": [
+      "--no-warnings",
+      "--no-deprecation"
+    ],
     "timeout": "120"
   }
 }